Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a new multi-account AWS architecture. The design includes two spoke VPCs (`vpc-app-a` and `vpc-app-b`) in the `us-east-1` Region, each with subnets across two Availability Zones (`us-east-1a` and `us-east-1b`). The enterprise also has an egress VPC (`vpc-egress`) in `us-east-1` to centralize internet-bound traffic, and an on-premises datacenter connected via AWS Direct Connect (DX). A Private Hosted Zone (PHZ) named `corp.internal` is hosted in a central networking account.

The architecture must meet the following requirements:
1. Spoke VPCs must be able to communicate with each other and with the on-premises datacenter.
2. All outbound internet traffic from the spoke VPCs must route through `vpc-egress` in a highly available manner that survives an Availability Zone outage.
3. Resources within the spoke VPCs must resolve DNS queries for the `corp.internal` domain.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Authorize and associate the `corp.internal` Private Hosted Zone in the central networking account with `vpc-app-a` and `vpc-app-b` using the AWS CLI or Route 53 API, and ensure that the VPCs have `enableDnsHostnames` and `enableDnsSupport` set to true.Answer
  2. Deploy an AWS Transit Gateway and attach both spoke VPCs and `vpc-egress`. Create a NAT Gateway in each Availability Zone of `vpc-egress`. Configure the spoke VPC route tables to route all outbound internet traffic (0.0.0.0/00.0.0.0/0) to the Transit Gateway, and configure the Transit Gateway route tables to route egress traffic to the `vpc-egress` attachments.Answer
  3. C
    Deploy an AWS Transit Gateway to connect the spoke VPCs. To minimize NAT Gateway hourly charges, deploy a single NAT Gateway in the `us-east-1a` subnet of `vpc-egress`, and configure the Transit Gateway route tables to route all outbound internet traffic (0.0.0.0/00.0.0.0/0) from both Availability Zones to this single NAT Gateway.
  4. D
    Associate all three VPCs directly with the Direct Connect Gateway (DXGW). Configure the DXGW routing tables to enable transitive VPC-to-VPC routing between `vpc-app-a`, `vpc-app-b`, and `vpc-egress`, bypassing the need to deploy an AWS Transit Gateway.
  5. E
    In the central networking account, set up a Route 53 Resolver outbound endpoint. Create a Resolver forwarding rule for the `corp.internal` domain pointing to the Amazon-provided DNS IP address (169.254.169.253169.254.169.253) in the spoke VPCs, instead of associating the Private Hosted Zone with the spoke VPCs.

Answer

To meet all requirements, the Solutions Architect must deploy an AWS Transit Gateway and associate the Private Hosted Zone with the spoke VPCs, while ensuring NAT Gateways are deployed in multiple Availability Zones within the egress VPC.
Associating the Private Hosted Zone with the spoke VPCs enables cross-account DNS resolution for internal resources, provided DNS hostnames and DNS support are enabled on those VPCs. Deploying Transit Gateway enables transitive routing between the spokes and to the egress VPC, and deploying NAT Gateways in multiple Availability Zones within the egress VPC ensures that outbound traffic routes remain resilient to Availability Zone failures.

Step-by-Step Solution

1
Design the routing architecture using AWS Transit Gateway to attach the spoke VPCs and the egress VPC, which allows VPC-to-VPC transitive communication and outbound routing to the egress VPC.
Transitive routing path established across all accounts and VPCs.
Direct Connect Gateway alone does not support transitive routing between attached VPCs.
2
Deploy NAT Gateways in multiple Availability Zones (both us-east-1a and us-east-1b) in the egress VPC.
Outbound internet traffic paths are made redundant across AZs.
Avoids introducing a single point of failure for internet egress traffic.
3
Perform cross-account Private Hosted Zone association by authorizing the association of the domain in the central networking account and associating it with the spoke VPCs.
The spoke VPCs can successfully resolve the private domain queries internally.
Private Hosted Zones must be explicitly associated with a VPC to allow local resolution.

Key Concept

Multi-account hybrid routing and cross-account Private Hosted Zone DNS resolution with highly available egress design.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic